How to update a record based on the primary key PUT method Express node.js

user_13729458 0
Viewed 90

I am a bit confused on how to use the put statement in node js at the moment, currently I am using:

app.put("/cars/:id", (req, res)  => { //get record based on id (uuid) e.g. http://localhost:3000/cars/a5ad957c-7d1b-11eb-8a21-0653a157c10e
        connection.connect(function(err) {
            connection.query(`UPDATE main.cars SET manufacturer= '${req.params.manufacturer}', WHERE id = '${req.params.id}')`, function(err, result, fields) {
                if(err) res.send(err);
                if(result) res.send(result);
            });
                
            });
        });

But I receive the following error in postman:

{ "code": "ER_PARSE_ERROR", "errno": 1064, "sqlMessage": "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = 'a5ad957c-7d1b-11eb-8a21-0653a157c10e')' at line 1", "sqlState": "42000", "index": 0, "sql": "UPDATE main.cars SET manufacturer= 'undefined', WHERE id = 'a5ad957c-7d1b-11eb-8a21-0653a157c10e')"

When I use the following query:

http://localhost:3000/cars/a5ad957c-7d1b-11eb-8a21-0653a157c10e?manufacturer=prius
express node.js mysql javascript
1 Answers

The simple answer here is that strings in SQL must be quoted with ' characters.

… however while adding them is a simple fix, it would leave you vulnerable to SQL injection attacks.

Look up how to use parameterized queries in whatever SQL library is giving you your connection object.

Dorward_190680
Related